03-wrong-region

Data leaves the approved region

JWT home_region does not match edge region

Valid JWT with home_region 'eu-west', but this edge deployment is configured for region 'tst'. Residency policy denies.

residencydeny

FIXTURE

tenant_id"acme-turkiye"

home_region"eu-west"

scopes

ai.chat.write

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS403

X-POLICY-DECISIONdeny

X-POLICY-REASONresidency.jwt_region_mismatch

OPA EXPECTATION

OPA.ALLOWfalse

DENY_REASONresidency.jwt_region_mismatch

DENY_CATEGORYresidency

What this demonstrates

A request tries to route to an AI model outside the approved geography. For EU personal data this is a cross-border transfer risk — the classic data-residency violation.

GDPR Ch. V (international transfers)

RUNNER

Execute scenario

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves residency enforcement. A user authorized in one region cannot make requests through an edge in another region.